CVE-2022-27978
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
A vulnerability in Tooljet v1.6 arises from improper handling of missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.
Risk Assessment
An attacker can reset any user's password without authorization, leading to account takeover and potential data breach.
Recommendation
Immediately update Tooljet to a version that includes a fix for this vulnerability and implement input validation in the API.
Other vulnerabilities in Tooljet
See all- CVE-2026-55413Critical
In ToolJet prior to version 3.20.178-lts, any authenticated user with builder role (free tier) could overwrite a globally-shared marketplace plugin with arbitrary JavaScript that executed server-side with full Node.js access. The malicious code ran whenever any user on the instance triggered a query using that plugin, leading to remote code execution (RCE) and supply-chain compromise of the entire ToolJet deployment.
- CVE-2026-73068Medium
ToolJet, an open-source platform for building internal tools, prior to version 3.20.207 has a vulnerability in the ToolJet Database HTTP API that authorizes operations against the :organizationId URL path value without verifying that the caller belongs to that organization. An authenticated user can set tj-workspace-id to their own workspace and target another workspace, allowing disclosure of table names, schemas, and rows and allowing tables to be created, altered, bulk populated, or dropped across tenant boundaries. This issue is fixed in version 3.20.207-lts.
- CVE-2026-54344Medium
A vulnerability in ToolJet before 3.20.180 allows shell command injection via pull request comments. The CI runner executes code from the comment, enabling theft of deployment secrets.
- CVE-2022-27979Medium
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.
Original NVD description (English source)
Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request.